picoCTF RPS writeup

picoctf-rps-writeup

We are given a Rock-Paper-Scissors game. I used wget to download the source file onto the webshell. I read the C source code.

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 


#define WAIT 60



static const char* flag = "[REDACTED]";

char* hands[3] = {"rock", "paper", "scissors"};
char* loses[3] = {"paper", "scissors", "rock"};
int wins = 0;



int tgetinput(char *input, unsigned int l)
{
    fd_set          input_set;
    struct timeval  timeout;
    int             ready_for_reading = 0;
    int             read_bytes = 0;

    if( l <= 0 )
    {
      printf("'l' for tgetinput must be greater than 0n");
      return -2;
    }


    /* Empty the FD Set */
    FD_ZERO(&input_set );
    /* Listen to the input descriptor */
    FD_SET(STDIN_FILENO, &input_set);

    /* Waiting for some seconds */
    timeout.tv_sec = WAIT;    // WAIT seconds
    timeout.tv_usec = 0;    // 0 milliseconds

    /* Listening for input stream for any activity */
    ready_for_reading = select(1, &input_set, NULL, NULL, &timeout);
    /* Here, first parameter is number of FDs in the set, 
     * second is our FD set for reading,
     * third is the FD set in which any write activity needs to updated,
     * which is not required in this case. 
     * Fourth is timeout
     */

    if (ready_for_reading == -1) {
        /* Some error has occured in input */
        printf("Unable to read your inputn");
        return -1;
    } 

    if (ready_for_reading) {
        read_bytes = read(0, input, l-1);
        if(input[read_bytes-1]=='n'){
        --read_bytes;
        input[read_bytes]='';
        }
        if(read_bytes==0){
            printf("No data given.n");
            return -4;
        } else {
            return 0;
        }
    } else {
        printf("Timed out waiting for user input. Press Ctrl-C to disconnectn");
        return -3;
    }

    return 0;
}


bool play () {
  char player_turn[100];
  srand(time(0));
  int r;

  printf("Please make your selection (rock/paper/scissors):n");
  r = tgetinput(player_turn, 100);
  // Timeout on user input
  if(r == -3)
  {
    printf("Goodbye!n");
    exit(0);
  }

  int computer_turn = rand() % 3;
  printf("You played: %sn", player_turn);
  printf("The computer played: %sn", hands[computer_turn]);

  if (strstr(player_turn, loses[computer_turn])) {
    puts("You win! Play again?");
    return true;
  } else {
    puts("Seems like you didn't win this time. Play again?");
    return false;
  }
}


int main () {
  char input[3] = {''};
  int command;
  int r;

  puts("Welcome challenger to the game of Rock, Paper, Scissors");
  puts("For anyone that beats me 5 times in a row, I will offer up a flag I found");
  puts("Are you ready?");

  while (true) {
    puts("Type '1' to play a game");
    puts("Type '2' to exit the program");
    r = tgetinput(input, 3);
    // Timeout on user input
    if(r == -3)
    {
      printf("Goodbye!n");
      exit(0);
    }

    if ((command = strtol(input, NULL, 10)) == 0) {
      puts("Please put in a valid number");

    } else if (command == 1) {
      printf("nn");
      if (play()) {
        wins++;
      } else {
        wins = 0;
      }

      if (wins >= 5) {
        puts("Congrats, here's the flag!");
        puts(flag);
      }
    } else if (command == 2) {
      return 0;
    } else {
      puts("Please type either 1 or 2");
    }
  }

  return 0;
}

The function of interest here is the play() function. Let’s say int computer_turn = 0, if we look at hands[0], we see that the computer chose ‘rock.’ On this page, I found the strstr() function returns a pointer to the position of the first occurrence of a string in another string. Now, the computer will check if the user input player_turncontains the string that corresponds to loses[0] i.e. ‘paper’.

I tried inputting the string rockpaperscissors 5 times to beat the game and there I found my flag:

flag

Total
0
Shares
Leave a Reply

Your email address will not be published. Required fields are marked *

Previous Post
part-68:-global-external-load-balancer-with-https-self-signed-certificate-in-gcp-cloud

Part-68: Global External Load balancer with HTTPS Self-signed certificate in GCP Cloud

Next Post
the-future-of-ai-in-search-|-whiteboard-friday-revisited-with-britney-muller

The Future of AI in Search | Whiteboard Friday Revisited With Britney Muller

Related Posts